Question

An enterprise vulnerability management team runs authenticated weekly scans across 40,000 assets. A new scan reveals 12,000 findings. Leadership wants remediation prioritized to reduce actual breach risk rather than simply clearing the largest raw CVSS numbers. Which approach best supports risk-based remediation scheduling at this scale?

Accepted Answer

Correlate each finding's CVSS with EPSS exploit-probability data, asset business criticality, and exposure/compensating controls, then schedule remediation on the highest combined-risk items first

Answer

Remediate strictly in descending CVSS base score order, starting with all 10.0 findings, then work down until the backlog is cleared

Answer

Group findings by scanner plugin family and patch whichever product has the most total findings, since that reduces the count fastest

Answer

Defer all remediation until the next quarterly penetration test confirms which vulnerabilities are actually exploitable in the environment